Input: evaluated risks. Action: perform treatment per clause 8. Trigger: planned intervals or events. Output: residual risks that are accepted or retained. 27001:2022 8.3 requires the treatment plans to be implemented, and the considerations of 8.6 apply here too.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.